tests/shell: Add test for bitwise avoidance fixes

Masked address matching was recently improved to avoid bitwise
expression if the given mask covers full bytes. Make use of nft netlink
debug output to assert iptables-nft generates the right bytecode for
each situation.

Signed-off-by: Phil Sutter <phil@nwl.cc>